Apache

Nifi

44 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2016-8748

  • EPSS 0.49%
  • Veröffentlicht 19.10.2017 20:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.

6.5

CVE-2017-12623

  • EPSS 0.51%
  • Veröffentlicht 10.10.2017 18:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users runni...

6.1

CVE-2017-7665

  • EPSS 1.06%
  • Veröffentlicht 12.06.2017 16:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.

7.5

CVE-2017-7667

  • EPSS 0.4%
  • Veröffentlicht 12.06.2017 16:29:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.